For now spec calls "holdbacks", which are designed for this purpose. Attestors will fail randomly for a set percentage of the requests so this can't be used as a whitelist. Surely this "holdbacks" will either be not implemented or dropped in no time by attestors.